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Abstract 

This paper analyzes a revised fragile watermarking scheme proposed by Botta 
et al. which was developed as a revision of the watermarking scheme previously 
proposed by Rawat et al. A new attack is presented that allows an attacker 
to apply a valid watermark on tampered images, therefore circumventing the 
protection that the watermarking scheme under study was supposed to offer. 
Furthermore, the presented attack has very low computational and memory 
requirements. 
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1. Introduction 

In recent years we have witnessed an impressive increase in the quantity of 
digital images being taken and transmitted, mostly due to the development of 
affordable digital cameras and to the high penetration rate of the Internet. This 
context has lead to an augmented effort of the scientific community to develop 
tools that protect digital images. One of these tools is fragile watermarking, 
which is supposed to protect the integrity and authenticity of digital images: a 
watermark is inserted in the image such that there are no perceptible changes 
to the human eye, but that it is possible to detect any malicious changes to the 
image. 

Various watermarking schemes have been proposed that work either in the 
pixel domain [niiia or in the transform domain miiHiiz]- As it is normal in 
cryptography, a lot of effort has also been put in attacking some of the proposed 
watermarking schemes [SlElIlo]. 

Rawat et al. have proposed a new fragile watermarking, [3] , that embeds the 
watermark in the LSB of every pixel. However, it was soon attacked by Teng 
et al. nni as well as by Botta et al. [S] and both papers have also presented 
revised versions of the algorithm. Teng et al.’s proposed fragile watermarking 
embeds a watermark, that is also a function of the pixel content, in one of the 
three least significant bits. A chaotic function is used to determine the exact 
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location of the watermark. Botta et al.’s fragile watermarking scheme generates 
a watermark that is a function of the pixel value, but always embeds it in the 
least significant bit of the pixel. This paper studies the security of Botta et al.’s 
fragile watermarking algorithm and shows that it is relatively easy to break. 

The rest of this paper is organized as follows. In Section [^we present the 
cryptographic perspective that we will use for the cryptanalysis as well as the 
different attack models, in order to better understand the cryptographic context 
of the attack we propose. Section [^presents the details of Botta et al.’s fragile 
watermarking and an example of its use. In Section |^we describe the proposed 
attack and we present one successful implementation of the attack. Section 
concludes our work. 


2. Cryptographic security 

Fragile watermarking is a cryptographic primitive because it tries to protect 
the integrity of some data, i.e. the image, in an adversary setting m- Therefore, 
in order for a fragile watermarking algorithm to be considered secure, it must 
respect Kerckhoffs Principle [HIS]. This means that the algorithm must be 
secure in the worst case scenario: when the attacker knows all the details of the 
algorithm except the secret key that was being used. Also, the algorithm must 
be secure in all of the 4 most common models of attack m- 

• ciphertext only model: the attacker only has access to some protected 
data. 

• known plaintext model: the attacker has access to some protected data 
as well as the corresponding unprotected data. 

• chosen plaintext model: the attacker is able to obtain the correspond¬ 
ing protected data of some (unprotected) data he chooses. 

• chosen ciphertext model: the attacker is able to submit some pro¬ 
tected data to the cryptographic primitive under attack and can obtain 
the corresponding unprotected data or the verification of its integrity. 

In the above enumeration we have used the terms ’’protected data” and ’’un¬ 
protected data” in order to make the definitions as broad as possible. For exam¬ 
ple, if the cryptographic primitive under study is an encryption algorithm, the 
’’protected data” is the ciphertext, while the ’’unprotected data” is the plaintext. 

This paper will present a chosen plaintext attack on a recently proposed 
fragile watermarking algorithm. In the case of fragile watermarking, the term 
’’protected data” refers to the watermarked image, while the term ’’unprotected 
data” refers to the unprotected image, i.e. the image prior to the embedding of 
the watermark. 
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3. Revised fragile watermarking algorithm 


Botta et al. have recently proposed a fragile watermarking algorithm [S] 

based on the cryptanalysis of Rawat et al’s fragile watermarking algorithm [5]. 

The proposed fragile watermarking algorithm embeds the watermark as follows: 

El. The original image, Ih, of size m x n is scrambled using Arnold cat map 
m k times, to obtain the scrambled image Is- 

E2. A chaotic sequence, C, is generated using logistic map m The sequence 
is of same size as the image It- Eurther, the values of C are rounded off to 
obtain a bit sequence. 

E3. For every pixel pi, of coordinates x and y, the binary chaotic watermark 
Wc{x,y) is computed as: 

Wc{x,y) = parity{W{x,y)®C[x,y) \ MACk{pi)ANDOx FE \ x \ y)) (1) 

where ” parity” means the number of bits with value one, W represents the 
original watermark, MAC is a Message Authentication Code and ” |” means 
concatenation. 

E4. Embed Wc in the LSB (Least Significant Bit) of every pixel of Is- 

E5. To obtain the watermarked image, 1^, Apply Arnold cat map T-k times, 
where T is the period of Arnold cat map. 

For watermark extraction from a watermarked image, /u,, the following steps 

need to be performed: 

Dl. The watermarked image is scrambled applying Arnold cat map k times, to 
obtain the image I^s- 

D2. The binary chaotic sequence C is computed exactly the same way as for 
the embedding process. 

D3. For every pixel pi, of coordinates x and y, an expected watermark is com¬ 
puted as: 


We{x,y) = parity{W{x,y)®C{x,y) \ MACk{pi)ANDOx FE \ x \ yj) (2) 


D4. A new image, Itemp, is constructed as the absolute difference between the 
expected watermark, We{x,y) and the LSB of every pixel of I-^s- 
D5. The tampered regions are detected applying Arnold cat map T-k times on 

^temp - 


We have implemented Botta et al’s watermarking algorithm and we present 
the results in Figure 

Figure la shows the original image, which has been watermarked with the 
watermark image shown in Figure |lb| The resulting watermarked image is 
presented in Figure We have tampered the watermarked image by inserting 
a boat on the lake, as shown in Figure |ld[ Then, we have applied the watermark 
detection and we have obtained the tampered regions presented in Figure 
We can conclude that the watermarking algorithm performs as expected. 


le 
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(a) Original image 




(b) Image watermark 



(c) Watermarked image 
- 



(d) Tampered image 



(e) Detected tampered images 


Figure 1: Botta et al’s fragile watermarking algorithm 
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4. Cryptanalysis 


In this section we will present an attack against Botta et al’s fragile water¬ 
marking scheme. We will first describe the attack and then show the results of 
its implementation 

^.1. Attack description 

The attack presented in this paper falls under the chosen plaintext model, 
i.e. the attacker needs to be able to obtain the watermarked version of some 
images he chooses. 

The watermarking algorithm under study is supposed to be secure because 
the embedded watermark in every pixel is a function of the secret key, the 7 most 
significant bits of the pixel and of the pixel coordinates. However, this means 
that if a pixel in a given location in the image, {x,y), has the same value in 
different images, the same watermarking bit will be embedded. Moreover, since 
the LSB of the pixel is used to embed the watermark, only 2^ = 128 possible 
values exist for every pixel position. 

Therefore, the attacker needs to know the watermarking bit Wc{i) for every 
pixel Pi, of coordinates x and y. For this, he will run the watermarking algo¬ 
rithm 128 times and will store the LSB plane of the watermarked image. With 
this information, the attacker will construct a three dimensional look-up table 
whose search fields will be the two coordinates, {x,y), and the value of the 7 
most significant bits of the pixel, and whose values will be the corresponding 
watermarking bit Wc{i)- This look-up table requires m x n x 128 bits storage 
space. 

Once the attacker has constructed the above mentioned look-up table, he can 
apply a valid watermark on any image. Therefore, the attacker has the ability to 
circumvent the protection offered by the watermarking algorithm under study. 

4-2. Implementation results 

We have implemented the proposed attack and we were able to apply a valid 
watermark on a tampered image, as shown in Figure 

Figure shows the image watermarked with the watermark image pre¬ 
sented in Figure |2b[ We have tampered this image by inserting a boat in the 
lake and we have used the attack presented in the previous subsection to apply 
a valid watermark on the tampered image. The resulting image is shown in 
When running the watermark detection algorithm, the LSB of all the pixels will 
be equal to the expected watermark computed using Eq. ([^, therefore the wa¬ 
termarking algorithm will not detect that there are tampered regions, as shown 
in Figure |2d| 

5. Conclusions 

This paper has analyzed the security of a recently proposed fragile water¬ 
marking scheme and has presented an attack that is capable to circumvent the 
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(a) Watermarked image 



(b) Image watermark 



(c) Attacked tampered image 



(d) Detected tampered regions 


Figure 2: Unsuccessful detection of tampered image 
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protection that the watermarking scheme under study is supposed to offer. Fur¬ 
thermore, the computational complexity of the attack is very small, only 128 
runs of the watermarking scheme are needed. Also, the memory requirements 
are very limited, only mxnx 128 bits are needed. We have abstained ourselves 
from proposing an improvement to the scheme because we feel there are a lot of 
available watermarking schemes and that the scientific community would benefit 
more from a thorough analysis of the already proposed watermarking schemes. 
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